How to Configure X-Pack for Active Directory

Elastic Stack Elasticsearch
1

Hi All,

I'm having a problem configuring Active Directory in X-pack for elasticsearch and kibana. May I know if there is a video tutorial or detailed steps for this? Currently, I have this setup.

Pasted image603×618 16 KB

but this is the error I received if I want to connect to my elasticsearch.

1 Like
2

Please use code snippets (the </> icon) instead of image attachments.

Are you trying to authenticate for many domains or a single one? The username in the error message has a NetBIOS domain name appended to the front. If using multiple domains you will need to connect to the global catalog port. https://www.elastic.co/guide/en/x-pack/current/active-directory-realm.html#_multiple_domain_support

3

Hi,

I'm only trying to connect to a single domain. How does URL work and how can I access the URL? Is the role_mapping I've provided correct? Should I also set the role.yml? Also, I cannot access the elasticsearch pretty using the account I provided in the role_mapping.yml. Should I create a separate folder for elastic in the Active Directory or can I use an existing one? if yes, how do you configure AD since I've tried the steps in the elastic site but it is not working. Maybe I've missed some details.

4

Did you use the proper values for your domain instead of domain.com? If so did you try logging in with just SQLENG.User2?

This blog may help some https://www.elastic.co/blog/quick-start-guide-configuring-elasticsearch-with-shield-and-active-directory

5

Hi,

Yes, I have configured the correct domain name. Should I also edit the role.yml of X-Pack? Is ingest node needed in the configuration?

6

It's hard for us to provide you with detailed information - we don't know the details for your Active Directory server, nor the exact configuration that you've used for your elasticsearch realm (since you've chosen to hide some of the private information).

The general advice that I can give is:

  • You should trying logging in as SQLENG.User2 (without the DS\\ domain prefix)

  • The URL should point to your Active Directory server. There are a number of LDAP tools that you can use to test whether you have configured the correct URL. If you do not have access to any such tools, you might want to check with your AD administrators, or you can search for something like ldap search tools {your-operating-system}.

  • X-Pack security makes a clear distinction between authentication (validating the username/password, etc) and authorization (roles, permissions, etc). The error message: unable to authenticate user ... implies that the problem is with authenticating the user against your AD server, and is not a problem with your roles and mapping. We cannot tell whether your role mapping is correct until the authentication problem is solved.

  • You will find more detailed error messages in the elasticsearch logs. By default this log is logs/elasticsearch.log but it may be in a different location depending on how you installed and configured your node. These logs will help with working out whether X-Pack Security is able to successfully connect to your AD server.

  • You can increase the level of logging by turning on debug logging for logger.org.elasticsearch.xpack.security.authc

8

Hi,

I have this configuration in my elasticsearch.yml

xpack:
security:
authc:
realms:
active_directory:
type: active_directory
order: 0
domain_name: ds.dev.com
url: ldaps://CTL16SP1W12R2AS.ds.dev.com:389
unmapped_groups_as_roles: false

native1:
type: native
order: 1
while for roles_mapping.yml

admin:

  • "CN=sqleng.user2,OU=SQL,OU=Lab,OU=CIO Segment Servers,DC=ds,DC=dev,DC=com"

Now elasticsearch is not running and not generating a log file.

Sorry but I am new with X-pack configuration.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.